[ruby-dev:11944] Re: core dump with GC and Ruby/zlib

In article <[e-mail]>,
  [e-mail] (Yukihiro Matsumoto) writes:

> これを「Rubyのバグ」と呼んじゃうのはRubyが(or 私が ^^;;;)か
> わいそうです。gもfもすでにゴミである以上、依存関係が保存され
> ることを期待してはいけないのではないかと思います。

ふと f の finalizer で g を close すればいいのではないか、と(愚かにも)
考えつき、試してみました。結果としてはうまく行かなかったのですが、
stack を食いつぶす症状を Ruby/zlib 抜きで再現させることに成功しました。

Z(2):akr@flux% (limit stacksize 180k; gdb ./ruby) 
GNU gdb 4.18
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd"...
(gdb) run -e 'f=open("zz","w");ObjectSpace.define_finalizer(f,Proc.new{f<<"a"})'
Starting program: /usr/home/akr/src/ruby/ruby/./ruby -e 'f=open("zz","w");ObjectSpace.define_finalizer(f,Proc.new{f<<"a"})'

Program received signal SIGSEGV, Segmentation fault.
0x80afe59 in rb_raise (exc=135259636, fmt=0x80b1880 "stack level too deep") at error.c:591
591     {
(gdb) where
#0  0x80afe59 in rb_raise (exc=135259636, fmt=0x80b1880 "stack level too deep") at error.c:591
#1  0x80585ab in rb_call0 (klass=135275296, recv=135255316, id=6337, argc=1, argv=0xbfbd3214, body=0x8101e98, nosuper=1)
    at eval.c:4209
#2  0x8058f36 in rb_call (klass=135275296, recv=135255316, mid=6337, argc=1, argv=0xbfbd3214, scope=1) at eval.c:4453
#3  0x8059159 in rb_funcall (recv=135255316, mid=6337, n=1) at eval.c:4527
#4  0x8068651 in io_write (io=135255316, str=135255196) at io.c:236
#5  0x805830c in call_cfunc (func=0x806855c <io_write>, recv=135255316, len=1, argc=1, argv=0xbfbd33f4) at eval.c:4116
#6  0x80587fd in rb_call0 (klass=135275296, recv=135255316, id=6337, argc=1, argv=0xbfbd33f4, body=0x8101e98, nosuper=1)
    at eval.c:4249
#7  0x8058f36 in rb_call (klass=135275296, recv=135255316, mid=6337, argc=1, argv=0xbfbd33f4, scope=1) at eval.c:4453
#8  0x8059159 in rb_funcall (recv=135255316, mid=6337, n=1) at eval.c:4527
#9  0x8068651 in io_write (io=135255316, str=135255196) at io.c:236
#10 0x805830c in call_cfunc (func=0x806855c <io_write>, recv=135255316, len=1, argc=1, argv=0xbfbd35d4) at eval.c:4116
#11 0x80587fd in rb_call0 (klass=135275296, recv=135255316, id=6337, argc=1, argv=0xbfbd35d4, body=0x8101e98, nosuper=1)
    at eval.c:4249
#12 0x8058f36 in rb_call (klass=135275296, recv=135255316, mid=6337, argc=1, argv=0xbfbd35d4, scope=1) at eval.c:4453
#13 0x8059159 in rb_funcall (recv=135255316, mid=6337, n=1) at eval.c:4527
#14 0x8068651 in io_write (io=135255316, str=135255196) at io.c:236
#15 0x805830c in call_cfunc (func=0x806855c <io_write>, recv=135255316, len=1, argc=1, argv=0xbfbd37b4) at eval.c:4116
#16 0x80587fd in rb_call0 (klass=135275296, recv=135255316, id=6337, argc=1, argv=0xbfbd37b4, body=0x8101e98, nosuper=1)
    at eval.c:4249
#17 0x8058f36 in rb_call (klass=135275296, recv=135255316, mid=6337, argc=1, argv=0xbfbd37b4, scope=1) at eval.c:4453
#18 0x8059159 in rb_funcall (recv=135255316, mid=6337, n=1) at eval.c:4527
#19 0x8068651 in io_write (io=135255316, str=135255196) at io.c:236
#20 0x805830c in call_cfunc (func=0x806855c <io_write>, recv=135255316, len=1, argc=1, argv=0xbfbd3994) at eval.c:4116
#21 0x80587fd in rb_call0 (klass=135275296, recv=135255316, id=6337, argc=1, argv=0xbfbd3994, body=0x8101e98, nosuper=1)
    at eval.c:4249
#22 0x8058f36 in rb_call (klass=135275296, recv=135255316, mid=6337, argc=1, argv=0xbfbd3994, scope=1) at eval.c:4453
#23 0x8059159 in rb_funcall (recv=135255316, mid=6337, n=1) at eval.c:4527
#24 0x8068651 in io_write (io=135255316, str=135255196) at io.c:236
#25 0x805830c in call_cfunc (func=0x806855c <io_write>, recv=135255316, len=1, argc=1, argv=0xbfbd3b74) at eval.c:4116
#26 0x80587fd in rb_call0 (klass=135275296, recv=135255316, id=6337, argc=1, argv=0xbfbd3b74, body=0x8101e98, nosuper=1)
    at eval.c:4249
#27 0x8058f36 in rb_call (klass=135275296, recv=135255316, mid=6337, argc=1, argv=0xbfbd3b74, scope=1) at eval.c:4453
#28 0x8059159 in rb_funcall (recv=135255316, mid=6337, n=1) at eval.c:4527
#29 0x8068651 in io_write (io=135255316, str=135255196) at io.c:236
#30 0x805830c in call_cfunc (func=0x806855c <io_write>, recv=135255316, len=1, argc=1, argv=0xbfbd3d54) at eval.c:4116
#31 0x80587fd in rb_call0 (klass=135275296, recv=135255316, id=6337, argc=1, argv=0xbfbd3d54, body=0x8101e98, nosuper=1)
    at eval.c:4249
#32 0x8058f36 in rb_call (klass=135275296, recv=135255316, mid=6337, argc=1, argv=0xbfbd3d54, scope=1) at eval.c:4453
#33 0x8059159 in rb_funcall (recv=135255316, mid=6337, n=1) at eval.c:4527
#34 0x8068651 in io_write (io=135255316, str=135255196) at io.c:236
#35 0x805830c in call_cfunc (func=0x806855c <io_write>, recv=135255316, len=1, argc=1, argv=0xbfbd3f34) at eval.c:4116
#36 0x80587fd in rb_call0 (klass=135275296, recv=135255316, id=6337, argc=1, argv=0xbfbd3f34, body=0x8101e98, nosuper=1)
---Type <return> to continue, or q <return> to quit---q
 at Quit
(gdb) up 1000000
#1875 0x8050161 in _start ()
(gdb) down
#1874 0x80501ea in main (argc=3, argv=0xbfbff300, envp=0xbfbff310) at main.c:50
50          ruby_run();
(gdb) 
#1873 0x8051808 in ruby_run () at eval.c:1172
1172        ruby_stop(ex);
(gdb) 
#1872 0x805171a in ruby_stop (ex=0) at eval.c:1149
1149        ruby_finalize();
(gdb) 
#1871 0x8051669 in ruby_finalize () at eval.c:1127
1127        rb_gc_call_finalizer_at_exit();
(gdb) 
#1870 0x8065839 in rb_gc_call_finalizer_at_exit () at gc.c:1236
1236                    run_final((VALUE)p);
(gdb) 
#1869 0x80657dc in run_final (obj=135255316) at gc.c:1219
1219                rb_protect(run_single_final, (VALUE)args, &status);
(gdb) 
#1868 0x8057d5e in rb_protect (proc=0x80656fc <run_single_final>, data=3217027380, state=0xbfbff130) at eval.c:3897
3897            result = (*proc)(data);
(gdb) 
#1867 0x8065712 in run_single_final (args=0xbfbff134) at gc.c:1199
1199        rb_eval_cmd(args[0], args[1]);
(gdb) 
#1866 0x8051ac5 in rb_eval_cmd (cmd=135255296, arg=135255256) at eval.c:1268
1268            return rb_funcall2(cmd, rb_intern("call"),
(gdb) 
#1865 0x80591c1 in rb_funcall2 (recv=135255296, mid=5433, argc=1, argv=0x80d9480) at eval.c:4537
4537        return rb_call(CLASS_OF(recv), recv, mid, argc, argv, 1);
(gdb) 
#1864 0x8058f36 in rb_call (klass=135259596, recv=135255296, mid=5433, argc=1, argv=0x80d9480, scope=1) at eval.c:4453
4453        return rb_call0(klass, recv, id, argc, argv, body, noex & NOEX_UNDEF);
(gdb) 
#1863 0x80587fd in rb_call0 (klass=135259596, recv=135255296, id=5433, argc=1, argv=0x80d9480, body=0x80fe57c, nosuper=1)
    at eval.c:4249
4249                    result = call_cfunc(body->nd_cfnc, recv, len, argc, argv);
(gdb) 
#1862 0x80582e1 in call_cfunc (func=0x805c37c <proc_call>, recv=135255296, len=-2, argc=1, argv=0x80d9480) at eval.c:4107
4107            return (*func)(recv, rb_ary_new4(argc, argv));
(gdb) 
#1861 0x805c5c5 in proc_call (proc=135255296, args=135255236) at eval.c:6194
6194            result = rb_yield_0(args, 0, 0, Qtrue);
(gdb) 
#1860 0x8057087 in rb_yield_0 (val=135255236, self=135306376, klass=0, acheck=2) at eval.c:3534
3534                result = rb_eval(self, node);
(gdb) 
#1859 0x8054680 in rb_eval (self=135306376, n=0x80fd5c8) at eval.c:2482
2482            result = rb_call(CLASS_OF(self),self,node->nd_mid,0,0,2);
(gdb) 
#1858 0x8058f36 in rb_call (klass=135275296, recv=135255316, mid=336, argc=1, argv=0xbfbfe9d4, scope=0) at eval.c:4453
4453        return rb_call0(klass, recv, id, argc, argv, body, noex & NOEX_UNDEF);
(gdb) 
#1857 0x80587fd in rb_call0 (klass=135275296, recv=135255316, id=336, argc=1, argv=0xbfbfe9d4, body=0x8101da8, nosuper=1)
    at eval.c:4249
4249                    result = call_cfunc(body->nd_cfnc, recv, len, argc, argv);
(gdb) 

> 今回の修正は「たまたま」T_DATAがT_FILEに依存していたから添付
> のパッチのような修正で対応できましたが、今後発生しうるあらゆ
> る依存関係に対応しようとしたら、ゴミに対してもなんらかのscan
> を行う必要があり、結果としてGCコストの増大を招くだけだと思い
> ます。

ちなみに、Java を調べてみたのですが、やはり finalizer の実行順序は保証
されていないようです。ただ、Java だと finalizer の実行時にはオブジェク
ト(およびそのオブジェクトからたどりつけるオブジェクトは)は回収されてい
ないことが保証されているようですが。
-- 
[田中 哲][たなか あきら][Tanaka Akira]
「ああ、それは大丈夫だよぉ。カイロを持って行くもぉん$(C⊇」
  (気象精霊記2 爆弾気分の低気圧, 清水文化)